Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German Government Agency warns about using Kaspersky

bsi.bund.de

Post reply on HN
Print view View original

131–140 of 147 posts

Re: German Government Agency warns about using Kaspersky

#131

Post by ho_schi »

boopmaster wrote: post #82
jeroenhd wrote: post #43

Earlier quoted context omitted.

Anti virus can be very helpful in corporate environments if set up right and managed by knowledgeable people. Those people are expensive, but they're life savers when John from marketing clicks the "enable editing" button in a spreadsheet he just received from a spoofed email address. The problem with corporate security is that security vendors often try to shovel as much crap onto your network as possible, rather th…

Working on a large corporation, I liken our AV deployments and endpoint security as the invisible hand of productivity destruction. I’m not saying these products don’t block malware, I’m not disagreeing with you at all. It should be stated that, with a high degree of confidence, deploying these measures against your internal employees personal systems and cloud deployments WILL invariably lead to the destruction of e…

When the AV killed here the first laptop I was surprised about how. It turned out that this "special" product sneaks into the hardware disk encryption (which is actually reliable) and rendered it useless. IT department shrugged and bought the next laptop...

Re: German Government Agency warns about using Kaspersky

#132

Post by ho_schi »

jeroenhd wrote: post #84
ho_schi wrote: post #62

Earlier quoted context omitted.

I've the users act right and use the package management and Steam, they will be fine. If the users decided to "save money" with warez, cracks and black market software they will suffer. And Antivirus software is available for Linux but only competent administrators use it, were needed.

You don't need warez at all. For example, people might want to run Microsoft Office on the deck if they hook it up to a dock (which Valve will sell later). You can't run Office on Linux, of course, but there are plenty of scripts you can download to set up a VM and do some remote desktop trickery (I've just recently gotten cassowary running on my laptop for exactly this use case). It's the small touches like these th…

The "I want it like Windows" people are an issue. Actually they were always? Old and bad behavior patterns. This hits the responsible people themselves. I'm feeling myself bad regarding using plugins from Github which aren't packaged by my distribution. And these plugin managers make it to easy :(

Regarding Flatpak (which I wish success) and Steam (which already has a lot success) I'm feeling more worried. They want grow and add stuff but actually must be a reliable source.

Re: German Government Agency warns about using Kaspersky

#133

Post by lpcvoid »

loufe wrote: post #124

I am not an IT professional but a bit confused by how many completely negative views there are here on AV use. I have a NOD32 license and at least twice per month a url is blocked while browsing in an unobtrusive way by the software, which makes sense as may have contained malicious JS or something. Maybe it would've been caught by ublock afterwards, or may have been caught by MS defender as well, but I like the assu…

The point is that the AV does not do much here. The security model should be proper sandboxing within the browser, along with block lists that get used by ublock origin if you wish. A third party program running alongside your browser, inspecting the URLs you visit (possibly then via TLS certificate MITM?), is just a weird way to think about security in my opinion. Not even talking about the potential new attack surface that may be introduced in some way.

Re: German Government Agency warns about using Kaspersky

#134

Post by kevingadd »

londons_explore wrote: post #86
kevingadd wrote: post #25

Earlier quoted context omitted.

It's definitely reasonable at this point to just skip using AV. It won't protect users from bad security habits and it tends to make your system performance worse even if it doesn't have vulnerabilities. I have Windows Defender enabled on my machines since it comes with the OS (and work policy requires it), but I definitely had to exclude most of my work folders to be able to get work done. It would be nice to have s…

> specifically blocks ransomware If microsoft made the "shadow copy"/"previous versions"/"system restore" functionality a core part of the kernel that even someone with admin rights can't mess with (which it almost is already), then that could be used to roll the system back to 5 mins before ransomware infection easily.

Ransomware usually has delayed activation built in, so that it's possible for it to spread or activate simultaneously once it's encrypted a bunch of machines, afaik

Re: German Government Agency warns about using Kaspersky

#135

Post by elesiuta »

ho_schi wrote: post #22

I warn about using any kind of snake oil. Often sold under the marking terms "antivirus" or "personal firewall" or "cloud cyber security". Known side effects of this treatment are high CPU load, high RAM consumption, drain of battery power. Sometimes they also consume your money or looking at your data. So far I would consider other counter measures, like applying user rights, proper package management and re-conside…

I agree with the snake oil sentiment, and wanting a tool to monitor connections on a per application basis but being dissatisfied with everything I found, I wrote my own (https://elesiuta.github.io/picosnitch/).

Only then did I discover that creating any sort of tool that is running on the same machine it is supposed to protect, if malware is also on said machine, is basically a fool's errand.

I tried to overcome as many of the pitfalls as I reasonably could, but reached a point now where the best approach is to just document any remaining limitations and some of the other counter measures you can use.

Re: German Government Agency warns about using Kaspersky

#136

Post by slenk »

lizardactivist wrote: post #125
GrumpyNl wrote: post #115

What do you guys recommend? Windows defender or?

I always recommend Kaspersky, as it's one of the best AV suites out there, and because there is still no proof whatsoever that the Russian government is "inside" KAV.

What makes it the best over other options? Windows Defender turned on plus a firewall protects like...everything.

Re: German Government Agency warns about using Kaspersky

#137

Post by elesiuta »

dspillett wrote: post #129
Ensorceled wrote: post #99

Earlier quoted context omitted.

It gets posted on HN EVERY SINGLE TIME. Usually the words "have backups" triggers multiple lectures on offsite backups and testing and multiple factors and ...

I'll stop repeating myself when the world gets the damned hint! (or stops complaining when something is lost because they didn't)

Even if/when the world does get the hint, there will still be https://xkcd.com/1053/ (although most people probably won't find this as exciting)

Re: German Government Agency warns about using Kaspersky

#138

Post by schleck8 »

GrumpyNl wrote: post #115

What do you guys recommend? Windows defender or?

Bitdefender is the most recommended other option. Sophos and F Secure are good too, so is Emsisoft and G Data. Depends on who you want to share your data with and how much you are willing to spend. Emsisoft is the least bloated option, they don't include all the password and vpn nonsense.

Re: German Government Agency warns about using Kaspersky

#139

Post by phendrenad2 »

fsflover wrote: post #109
phendrenad2 wrote: post #89

Earlier quoted context omitted.

That's bad advice. It's a trade-off. Installing antivirus opens some security holes and closes others. It also adds heuristic analysis. It seems to me that the security world has come to the consensus that AV is better than no AV.

> the security world has come to the consensus Any links? If you really care about security of your OS, consider security through compartmentalization approach, which actually works. See also: https://qubes-os.org .

Security and convenience are on a spectrum. Often security works against itself by being too inconvenient, leading to human attacks as people work around the security features. If someone wants more security, it doesn't mean that they "really care about security" and want 100% bulletproof coverage. There are grey areas.
Post reply on HN